There are times when a user (be it a person or a process on a computer) is interested in knowing what is happening on a computer system. Obviously, the user could sit and watch the computer system over time, observing changes as they happen. But this is not a practical solution: the user would need to dedicate at least some of his attention to the computer system, and the computer system would have to grant the user fairly unfettered access to the computer system to check for events.
Rather than having the user directly observe the computer system, an alternative approach is to program the computer system to inform the user of events occurring on the system. This approach is better, in that it allows the user to do something other than direct his attention to the computer system. Once an event occurs, the computer system notifies the user of the event.
But there are some problems with this approach. First, the computer system informs the user of events one at a time. Although sometimes a user is interested in only individual events, more often the user is interested in looking at a number of events occurring over a period of time. Second, the interfaces to such systems are usually proprietary. That is, to request that a user be notified of events, the user must use special tools, both to make the request and to receive the events.
As an example of the first problem, consider a backup tool archiving the computer system. The backup tool is not interested in receiving individual events indicating changes to files on the computer system: the backup tool only wants to know what files have changed after the time the backup tool performs the archive. If the backup tool only receives individual events, the backup tool must then track the events until it is time to perform the archive.
A need remains for a way to provide a user with means to access events in a sequence preferably using a non-proprietary interface that addresses these and other problems associated with the prior art.